generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/hevc_ps: Check num_long_term_ref_pics_sps

Browse Source 
Fixes out of array access
Fixes: signal_sigsegv_35bd0f0_1182_cov_791726764_STRUCT_B_Samsung_4.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2014-11-28 03:46:56 +01:00
parent cfd83a8af6
commit ea38e5a6b7
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/hevc_ps.c
View File

@ -951,6 +951,11 @@ int ff_hevc_decode_nal_sps(HEVCContext *s)
sps->long_term_ref_pics_present_flag = get_bits1(gb);
if (sps->long_term_ref_pics_present_flag) {
sps->num_long_term_ref_pics_sps = get_ue_golomb_long(gb);
if (sps->num_long_term_ref_pics_sps > 31U) {
av_log(0, AV_LOG_ERROR, "num_long_term_ref_pics_sps %d is out of range.\n",
sps->num_long_term_ref_pics_sps);
goto err;
}
for (i = 0; i < sps->num_long_term_ref_pics_sps; i++) {
sps->lt_ref_pic_poc_lsb_sps[i] = get_bits(gb, sps->log2_max_poc_lsb);
sps->used_by_curr_pic_lt_sps_flag[i] = get_bits1(gb);